Skip to content
Permalink
Branch: master
Find file Copy path
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
101 lines (87 sloc) 2.8 KB
#!/bin/bash
# Check FreeRADIUS Server Status
# by Dan Barrett
# http://yesdevnull.net
# v1.0 - 24 August 2013
# Initial Release
# v1.1 - 27 October 2013
# Updated for OS X Mavericks
# This script does a number of checks to verify that the FreeRADIUS server is running.
# Please ensure you have a valid user account to check the full status of the server.
# Arguments:
# -u Username to test authentication
# -p Password for the above user
# -h The host for the FreeRADIUS server (usually localhost)
# -a The port for the FreeRADIUS server (usually 1812)
# -s The shared secret for the IP address you're connecting from (testing123 if testing on localhost)
# Example:
# ./check_radius.sh -u fakeuser -p fakepass -h localhost -a 1812 -s fake_shared_secret
# Supports:
# * OS X 10.8 Mountain Lion, Server 2.2.x
# * OS X 10.9 Mavericks, Server 3.0
# We need to run this as root because FreeRADIUS requires it, plus we write a temp log file
if [[ $EUID -ne 0 ]]
then
echo "ERROR - This script must be run as root."
exit 1
fi
# Set up the basic variables
username=""
password=""
host=""
port=""
secret=""
while getopts "u:p:h:a:s:" opt
do
case $opt in
u ) username=$OPTARG;;
p ) password=$OPTARG;;
h ) host=$OPTARG;;
a ) port=$OPTARG;;
s ) secret=$OPTARG;;
esac
done
# Check to see if we're running Mavericks Server as RADIUS runs a little differently
osVersion=`sw_vers -productVersion | grep -E -o "[0-9]+\.[0-9]"`
isMavericks=`echo $osVersion '< 10.9' | bc -l`
if [ $isMavericks -eq 0 ]
then
# 10.9+ Check
# Quick check to see if FreeRADIUS is even running
if [ "`ps -ef | grep radiusd`" == "" ]
then
echo "CRITICAL - RADIUS is not running!"
exit 2
fi
else
# < 10.9 Check
# Quick check to see if FreeRADIUS is even running
if [ "`ps aux -o tty | grep "/usr/sbin/radius"`" == "" ]
then
echo "CRITICAL - RADIUS is not running!"
exit 2
fi
fi
# Attempt to authenticate with the FreeRADIUS server, using the credentials and details above, then send stderr to a temp log file
authAttempt=`echo "User-Name=$username,User-Password=$password,Framed-Protocol=PPP " | radclient -x -r 1 -t 2 $host:$port auth $secret 2> /tmp/radius_error`
# Assign the stderr log file to a variable
radiusStderr=$(</tmp/radius_error)
# What did authAttempt return? Good news I hope.
if [ `echo $authAttempt | grep -o "Access-Accept"` ]
then
# Success!
echo "OK - RADIUS is running and accepting connections."
exit 0
elif [ `echo $radiusStderr | grep -o "Shared"` ]
then
echo "WARNING - RADIUS is running, but your shared secret is incorrect."
exit 1
elif [ `echo $authAttempt | grep -o "Access-Reject"` ]
then
echo "WARNING - RADIUS is running, but your credentials are incorrect."
exit 1
else
# If we get some other error, return a generic error
echo "CRITICAL - RADIUS is running but not accepting connections!"
exit 2
fi
You can’t perform that action at this time.